On Tuesday 2010-11-02 10:55, Pascal Hambourg wrote: >Hello, > >Alex a Ãcrit : >> >> I've set up a few basic rules to throttle SMTP traffic from an >> individual host should they make more than 10 connections in ten >> seconds: >> >> iptables -I INPUT -p tcp --dport 25 -i eth0 -m state --state NEW -m recent --set >> iptables -I INPUT -p tcp --dport 25 -i eth0 -m state --state NEW -m >> recent --update --seconds 10 --hitcount 10 -j LOG >> iptables -I INPUT -p tcp --dport 25 -i eth0 -m state --state NEW -m >> recent --update --seconds 10 --hitcount 10 -j DROP >> >> Is this the correct way to do this? I notice the seconds value can't >> be any greater than 20. What is the reason for this? > >--seconds or --hitcount ? The --hitcount value cannot be greater that >the ip_pkt_list_tot parameter of the ipt_recent/xt_recent kernel module >(otherwise it would never match), and the parameter default value is 20. >See the iptables man page for details. And on newer kernels (>= 2.6.34), this is also communicated through a line in dmesg. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
